by Kastro
Paper/Archive/CVE-2025-1515

CVE-2025-1515

Chimpstudio WP Real Estate Manager — WP Real Estate Manager <= 2.8 - Authentication Bypass via Account Takeover

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 46.4.464 × 209.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The WP Real Estate Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.8. This is due to insufficient identity verification on the LinkedIn login request process. This makes it possible for unauthenticated attackers to bypass official authentication and log in as any user on the site, including administrators.

Affected

ProductAffectedFixed inSource
WP Real Estate Manager≤ 2.8–CNA

Scores by source

Wordfence (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/84f08111-d116-46f9-9765-28966e338753?source=cverefthemeforest.net/item/home-villa-real-estate-wordpress-theme/19446059